Skip to content
Media
ASD ISMISM-0351

ASD ISM 0351 Proper method for volatile media sanitisation

What it says

Volatile media is sanitised by removing its power for at least 10 minutes.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Turn off power to the storage device for 10 minutes to fully clear data.

Volatile media, like computer memory, only holds data while it's powered on. This control ensures you turn off power for at least 10 minutes to completely erase any data. If you skip this step, sensitive information could remain and fall into the wrong hands, risking privacy breaches or data leaks.

Why it matters

If power is not removed for at least 10 minutes, volatile media may retain data and enable exposure of residual memory contents.

How to implement

  1. IT staff should be responsible for powering down devices: To properly clear volatile media, ensure that computers or devices are turned off completely for at least 10 minutes.

    This can be done by powering off through the operating system and unplugging from power sources to ensure data is purged.

  2. System owners should document the shutdown process: Create a procedure document outlining how and when devices should be powered down for data sanitisation.

    Distribute these procedures in staff meetings or via internal communications to ensure everyone understands the process.

  3. Managers should schedule regular checks: Set up a routine check to ensure that the procedure to turn off devices for 10 minutes is followed consistently.

    This can be done through random spot checks or integrating it into weekly maintenance tasks.

  4. Human Resources should inform new employees: During onboarding, include a section on data handling and device use that covers the importance of this control.

    Make sure new joiners understand the policy and its role in protecting sensitive data.

  5. Procurement should coordinate with IT for disposal: When removing or recycling devices, make sure there's a coordinate plan for powering them down properly.

    Inform the recycling vendor about this requirement to prevent any data from remaining on the device.

Keep it running

Ensure volatile media is powered off for at least 10 minutes and record the start/finish times to confirm sanitisation has occurred.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    The written procedure for sanitising volatile media: Verify that the document includes steps for shutting down the devices and the importance of the 10-minute rule.

    Good evidence

    Includes clear instructions and the rationale behind them, showing the procedure has been reviewed and authorised.

  2. Check 2 of 4What an auditor asks for

    Look at

    Records of routine checks or logs: Request logs or records that show when devices were turned off to sanitise data. Good records will show consistent power-down times and any corrective actions taken if discrepancies were found.

  3. Check 3 of 4What an auditor asks for

    Ask for

    Them to describe the steps they take to ensure the media is properly sanitised.

    Good evidence

    Includes knowing the 10-minute rule, when they carry it out, and how they verify it's done correctly.

  4. Check 4 of 4What an auditor asks for

    Ask for

    If data handling and device shutdown procedures are part of the onboarding process.

    Good evidence

    Confirmation includes details of training materials or sessions and feedback from new employees acknowledging understanding.

Mappings

Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.

ISO 27001

ISO/IEC 27001: 3 mappings

  • A.7.10Secure management of storage mediaPartially meets
  • A.7.14Secure disposal or re-use of equipmentPartially meets
  • A.8.10Secure deletion of information when no longer neededPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.